Attackers Hit Rejetto HFS: Weak RNG Opens the Door to Admin Session Forgery

VulnCheck reports active exploitation attempts against a critical vulnerability in Rejetto HTTP File Server (HFS). Tracked as CVE-2026-61500, it carries a CVSS score of 9.3.

What the flaw is

In HFS versions 3.0.0 through 3.2.0, the key used to sign session cookies is derived from the non-cryptographic Math.random() generator. Worse, the server discloses output from that very same generator to unauthenticated clients during the login (SRP handshake) process.

That is enough to break it: by collecting a small number of login responses, an attacker can reconstruct the generator's state, recover the signing key, and forge a valid administrator cookie. From there the built-in server_code configuration feature — which runs server-side JavaScript — hands over arbitrary code execution.

Who found it, and when it was fixed

The vulnerability was discovered by Horizon3.ai researcher Zach Hanley, who says Anthropic's Mythos model helped surface it. Hanley described it as an authentication bypass offering a clear path from unauthenticated access to administrative control and remote code execution.

A patch shipped back in July 2026 in version 3.2.1. But it was only in late September that a Python proof-of-concept appeared publicly, released by researcher Alejandro Ramos (aramosf).

Exploitation in the wild

According to VulnCheck's Patrick Garrity, the first exploitation attempts were seen on October 1, 2026 — a day after Horizon3.ai published further details. The firm traced an unnamed China-based threat actor targeting genuinely vulnerable hosts in the U.S.

This is the second actively exploited bug in Rejetto HFS. The first, CVE-2024-23692 (CVSS 9.8), was weaponized in the summer of 2024 to deliver cryptocurrency miners, trojans, and malware known as HATVIBE.

Administrators running HFS should update to version 3.2.1 without delay.

Source: The Hacker News